From 1 October 2026, all healthcare provider organisations registered with My Health Record must comply with the security and access policy requirements set out in rules 21 and 43 of My Health Record Rules 2026. These requirements replace security and access policy requirements previously set out in rule 42 of My Health Records Rules 2016.

The My Health Record Regulations 2026 and Rules 2026 commenced on 1 April 2026, updating and simplifying requirements for providers while maintaining existing privacy and security protections. 

Important reminders   

• Existing participants (registered before 1 April 2026): transitional arrangements apply until 30 September 2026. Compliance with the new 2026 Rules after this date is mandatory.   
• New participants (registered on or after 1 April 2026): must comply with the 2026 Rules.   

All organisations accessing My Health Record must maintain:   

• auditable user account logs   
• Security and Access Policy with annual reviews and supporting evidence   
• staff training and record-keeping documentation   
• cyber security awareness and data breach management processes. 

Further information and resources

Please reach out to SEMPHN’s Digital Health team via email – digitalhealth@semphn.org.au or call our team on (03) 8514 4460 if you have any further questions.